Time Tracking
The Time Tracking space module, in the Planning & HR tab. Employees clock in and out in the app and get a receipt; nothing that was punched can be changed; the direct leader handles missing punches; the management team sets the working-hours rules, closes the month with the timesheet and generates the CSV, the AFD and the AEJ in the Portaria 671 layout.
Time Tracking is the community's electronic record of working hours: each employee clocks in and out in the app, with the server's time, and gets a receipt for the punch; the direct leader handles what is missing; the management team sets the schedule and the rules, closes the month with the timesheet and generates the files for payroll and for an auditor. The module follows the rules for a software-based electronic time recording system set by Portaria MTP 671/2021 (the Brazilian labor ministry's ordinance on time tracking) as far as the product reaches, on a best-effort basis.
It is a space module in the Planning & HR tab of Add Space. A community can have as many time tracking spaces as it wants (for example one per company or per site), and each one points to one establishment, the employer behind the punches. Who creates the space: owner or admin.
What it is for
| Community | How it uses it |
|---|---|
| Company with CLT employees (Brazil's formal employment regime) | Everyone's punches, with the month's timesheet to check and the closing for payroll |
| Group with more than one CNPJ | One space per company, each with its own establishment and its own numbering |
| Coworking or office with its own staff | A Staff time tracking space, open only to the employees' group |
Who sees and does what
The time tracking management is the owner, the admin and finance. Each person's leader is their Reports to in the org chart, worked out at the moment of each action.
| Who | Clocks in/out | Sees punches, timesheet, CPF, IP and location | Adjustments | Management |
|---|---|---|---|---|
| The employee | Yes, if they have an employee record | Their own | Requests and cancels their own; acknowledges the closed month | No |
| Direct leader | If they are an employee | The team's, direct and indirect | Decides those of their direct reports | No |
| Indirect leader (the leader's leader) | If they are an employee | The team's, read-only | Doesn't decide | No |
| Finance | If they are an employee | Everyone's | Decides those of people without a leader | Establishment, employees, rules, holidays, closing and files |
| Owner and admin | If they are an employee | Everyone's | Decides those of people without a leader | Everything finance does, and also reopens a month |
| Moderator and other members | If they are an employee | Only their own (a moderator, the team's if they lead someone) | Only their own | No |
- Anyone not in the table doesn't see anyone's punches: for that person, other people's timesheets simply don't exist.
- An employee's CPF (Brazilian individual taxpayer number) only shows to the person themself, their leaders and the management team.
- When Memberfy support enters the community (the Enter button), it neither sees nor touches time tracking.
How it works
The space's tabs
| Tab | What it shows | Who sees it |
|---|---|---|
| Clock in/out | The clock with seconds and the Clock in/out button, or whom to ask for a record | Everyone with access to the space |
| Timesheet | Your month, Day by day, with Request adjustment and Acknowledge; the leader and the management team pick the person | Everyone with access to the space |
| Punches | Mine (with each one's receipt), My team's and All, with CPF, IP and location | Mine: everyone; My team's: whoever leads someone; All: time tracking management |
| Adjustments | My requests, To decide, My team's and All | Depending on what each person requests, decides or sees |
| Team month | The month's totals per person and the Manage the month bar (Export CSV, Close month, Reopen month, Month history) | Whoever leads someone (the team) and the management team (everyone) |
| Rules and holidays | The space's Rules and Holidays | Time tracking management |
| Employees | Who has access to the space, with or without an employee record, and each person's record | Time tracking management |
| Establishment, AFD and AEJ | The space's employer and the AFD and AEJ generation | Time tracking management |
The tabs show up according to what each person can see: someone who leads nobody and isn't in the management team sees Clock in/out, Timesheet, Punches and Adjustments.
The establishment
The establishment is the employer: the punches are made in its name, on the receipt and in the files.
| Field | What for |
|---|---|
| Employer's CNPJ or CPF | With the check digit verified. A CNPJ or CPF can only be registered once per community |
| CEI, CAEPF or CNO | Optional, for those who have one |
| Legal name | The employer's name |
| Workplace | Where the work is done; it goes on the receipt |
The establishment step comes prefilled with the community's company details (those in Business information: CNPJ or CPF, legal name and the address as the workplace); check and adjust them before saving. Whoever saves enters their own CPF, which goes into the record.
Two spaces can use the same establishment: they then share the same numbering and the same AFD, but one space's punches, rules, adjustments and closings don't show in the other. Once a space has punches, its establishment can no longer change.
Every addition or change to the establishment is saved in the record, with its own number.
The employees
Only people with an employee record at the space's establishment can clock in. The management team registers:
| Field | What for |
|---|---|
| Person | Someone in the community with access to the time tracking space |
| CPF | With the check digit verified; the same CPF can't be in two records at the establishment |
| Hire date | No adjustment applies before it |
| Job title or role | Goes on the timesheet |
| eSocial registration | Optional (eSocial is the Brazilian government's payroll reporting system) |
Adding, changing and removing a record is saved in the record. Removing ends the record: the person stops clocking in at that establishment, and the punches they already made are kept forever.
Someone who opens the space without a record doesn't see Clock in/out and reads whom to ask: "To punch the clock, ask an owner, admin or finance person of the community for your employee registration (CPF, admission date and job title)."
Clocking in/out
- The employee opens the space and sees the clock, with hours, minutes and seconds. The time that counts is the server's, synchronized with Brazil's legal time; the phone's or computer's clock doesn't count.
- The first time, the screen warns that the punch records the IP and location as proof of the working-hours record. The notice shows once per space, and Memberfy keeps when the person saw it.
- The person taps Clock in/out. The app asks the browser or phone for the location.
Each punch saves the time, the establishment's sequential number (NSR, with no gaps and no repeats), the CPF, the IP, the browser and, if the device provides them, the latitude, the longitude and the accuracy. It also carries an integrity code (SHA-256 hash) chained to the establishment's previous punch.
Without an allowed radius, a punch is never rejected. Without a location, it goes in and is flagged no location; outside the contractual schedule or on a day off, it goes in and is flagged outside the schedule. No working-hours rule blocks the punch. A double tap doesn't create two punches. With the allowed radius in Block mode, a punch outside the radius or without a location is refused.
Allowed radius (virtual fence)
Optional. On the Establishment, AFD and AEJ tab, the owner and the admin set, per time tracking space, the Workplace (through the address search or Use my location; the address is only a label), the Radius (10 to 50,000 meters) and what happens Outside the radius:
| Mode | What happens |
|---|---|
| Block | A punch outside the radius, or without a location, is refused: "You are 350 m from the workplace, outside the allowed radius of 200 m. The punch was not recorded." or "This time clock only accepts punches with location. Turn on your device location and try again." The attempt is recorded for the management, without becoming a punch |
| Flag | The punch is recorded with the Outside the radius badge and the distance, on the receipt screen, in the punches, on the timesheet and in the month's CSV |
- Whoever punches sees the rule on the punch screen ("This time clock only accepts punches with location, within 200 m of the workplace.") and in the IP and location notice.
- Punches refused by the radius, on the same tab, lists the attempts of the last 30 days: who, when and the distance (or No location). They aren't punches: they have no NSR, don't go to the AFD or the AEJ and don't enter the timesheet. The owner, the admin and finance see the list.
- The Outside the radius badge doesn't go to the AFD or the AEJ, which follow the Ordinance's layout.
- Remove radius goes back to working without a radius: no punch is refused or flagged, and what was already recorded stays. With no radius set, nothing changes.
The rule is the company's. Memberfy applies the chosen radius and mode, without assessing whether they meet the law or each company's contracts. The location comes from the device or browser of whoever punches: the radius is a control of the company's routine, not proof of presence at the place.
The receipt
Right after punching, the person opens and downloads the Worker Time Record Receipt, as a PDF, with the NSR, the employer (name, CNPJ or CPF, CEI/CAEPF/CNO), the workplace, the worker (name and CPF), the date and time of the punch and the hash code. Receipts for any period stay available afterwards, with no time limit, in Punches › Mine. There is no e-mail per punch.
Nothing that was punched can be changed
A punch is neither edited nor deleted, by anyone: not the owner, not Memberfy support. There is no button or route for it, and the database refuses the change. The same goes for the establishment's and the employees' records. What gets corrected is the treatment, through an adjustment.
Adjustments
An adjustment corrects the timesheet without touching the record:
| Type | When | What it asks for |
|---|---|---|
| Include | The person forgot to punch | The day, the time (never in the future or before the hire date) and the reason |
| Disregard | A wrong punch (punched twice, punched in the wrong space) | Which punch and the reason |
- The employee requests an adjustment to their own time record. Nobody requests one for someone else.
- The person's direct leader decides, and gets the notice by e-mail. For someone without a leader, the management team (owner, admin or finance) decides. Nobody decides their own adjustment, and the indirect leader only sees it.
- The leader decides with Approve or Reject, in Adjustments › To decide; rejecting asks for a required note to the person, who gets the notice of the decision.
- While the adjustment is waiting, the person can Cancel request, in Adjustments › My requests.
Once approved, the timesheet and the AEJ show the treated punch, with the reason (on the timesheet, the included one shows with incl. and the reason). The AFD doesn't change, and the included punch gets neither an NSR nor a receipt.
Overtime isn't included through an adjustment: it comes from the punches. To record overtime, the person clocks in/out.
The sole owner. If the owner has no leader and is the only person in the management team, there is nobody to decide their adjustment: in that case they decide their own, and the decision is flagged as self-decided on the adjustment, on the treated punch and on the timesheet day (and in the CSV). If there is someone else in the management team, that person decides.
Working-hours rules
In Rules and holidays › Rules, the management team chooses in Rule for whether the version applies to The whole space or is an Exception for one person (with Also apply to, the same exception applies to the people in a group), and in Effective from the date it starts. The screen is split into Working hours, Tolerance and overtime, Night and breaks and History. Each change saves a new version; previous ones stay in the History. A rule can't start inside a month that is already closed.
All the numbers below are defaults the community adjusts, not legal advice. No rule rejects a punch: they say what is expected, what is counted and what is flagged.
| Rule | Default |
|---|---|
| Contractual schedule | Monday to Friday, 08:00–12:00 and 13:00–17:00. Up to 6 in/out pairs per day, at most 16 h in the day; a day with no pairs is a day off. An out before the in crosses midnight |
| Tolerance | 5 minutes per punch and 10 minutes per day. Within it, neither lateness nor overtime |
| Overtime | Daily (50% premium), weekly above 44 h (50%, counted in the month of the week's last day), on a day off (100%) and on a holiday (100%). Each type has its own multiplier |
| Daily limit warning | 2 h of overtime in the day; it only flags |
| Overtime destination | Pay or Hour bank |
| Hour bank | 6-month validity (up to 12) |
| Weekly rest | Sunday; it can be another day or none |
| Night work | From 10 p.m. to 5 a.m., with a 20% premium; the reduced night hour (52min30s, so 7 clock hours count as 8) is optional |
| Minimum break | 1 h above 6 h worked; 15 min from 4 to 6 h. It only flags |
Holidays. The space already comes with Brazil's national holidays for this year and next, and those of the following years are added automatically. In Rules and holidays › Holidays, each one shows as National or Community's; the management team uses Add holiday for its own (municipal, company) and Remove holiday for what doesn't apply; a removed national holiday doesn't come back. A holiday in a closed month can't be added or removed.
Shift that crosses midnight. It counts on the day of the in, if the out comes within 16 h.
The timesheet
The timesheet is a person's month, on the Timesheet tab (Day by day) and in the CSV. The person sees theirs every month; the leader sees the team's; the management team sees everyone's.
- Header: the employer (name, CNPJ or CPF, CEI/CAEPF/CNO), the worker (name, CPF, hire date, job title), the issue date, the period and the contractual schedule.
- Each day: the recorded punches and the treated ones (included and disregarded, with the reason), each with IP and location.
- Totals: regular hours, overtime by type, with the premium and the destination (paid or bank), night hours (with the reduced hour, when on), absences, lateness beyond the tolerance and the hour bank.
- Flags: no location, outside the schedule, missing out, minimum break, daily overtime limit and self-decided.
When the timesheet starts counting. Absences, expected hours and the weekly rest day only count from the later of the person's hire date and their registration in the establishment, and stop when the registration ends. Someone registered mid-month gets no absences for the days before.
Hour bank. With the bank destination, overtime becomes a credit and time missing beyond the tolerance becomes a debit, minute by minute. A full day's absence is still an absence and doesn't come out of the bank. Each month of origin forms a batch, which expires at the end of the month of origin plus the validity (with 6 months, January's hours expire at the end of June); a debit consumes the oldest batch first, and a credit first pays off what is owed. The balance can go negative. What expires shows as expired, to be paid. The timesheet shows the opening balance, the credits, the debits, the expired hours, the balance and the batches with the month they expire.
Close and reopen the month
| Action | Who | Rules |
|---|---|---|
| Close month | Time tracking management | The month is over; months close in order; no adjustment waiting for a decision in the month. Each person's totals are frozen, and each employee gets an e-mail to check theirs |
| Acknowledge | The employee | On the Timesheet, marks the closed month as seen. Repeating it doesn't change the date |
| Reopen month | Owner or admin | With a reason, which stays in the history; from the most recent month backwards |
Closing and reopening are on the Manage the month bar of the Team month tab. A closed month takes no adjustment, rule or holiday. The Month history shows who closed, reopened and acknowledged, and when. Each person's acknowledgement shows only to them, to their leaders (direct and indirect) and to the management team; only the management team reads the reason for reopening.
Export and generate the files
| File | What it is | Per |
|---|---|---|
| Monthly CSV | For payroll: one total row per person, one per day and one per punch (recorded or treated), with IP and location, in the community's time zone. It includes whoever punched in the month or has access today, even people who have left | Space and month |
| AFD | The file of recorded punches (source data file), in the Portaria 671 layout (version 004), with the employer's and employees' records | Establishment and period, up to 366 days |
| AEJ | The file of treated working hours (electronic working-hours file), in the Portaria 671 layout (version 002): contractual schedules, treated punches with the reason, weekly rest days, absences, hour bank and holiday days off | Establishment and period, up to 366 days |
The CSV comes in the language of the person who exports it: translated headers and values, with the Portaria codes kept as they are (E/S/D for in, out and disregarded; O/I for original and included) and numbers with a dot as the decimal separator, so payroll reads them without conversion.
In the AEJ, each person is one link per establishment: punches from several spaces of the same establishment are merged, each day only once. The weekly rest day (DSR) only appears for weeks that have already ended.
The AFD and the AEJ come with a .sha256 file, holding the file's integrity code, so whoever receives them can check nothing changed. The download links work for 5 minutes; generate them again when you need to.
For an auditor. The AFD can be generated at the moment of the request; the AEJ and the timesheets, for any period, at any time. Hand over the files with their .sha256.
E-mails
The Time tracking category of E-mails from this community, on by default, has three notices, never with times, reason or note, only the notice and the button:
| Notice | Who gets it | Button |
|---|---|---|
| So-and-so requested a time tracking adjustment | Whoever decides: the direct leader or, without a leader, the management team | See the request |
| So-and-so decided your time tracking adjustment | The person | See the decision |
| Your timesheet was closed | Each employee in the month | See the timesheet |
Step by step
Create the space and register the establishment
Role: owner or admin.
- Add Space › Planning & HR › Time Tracking. The card says "Clock-in and clock-out with a receipt and the AFD file".
- Give it a name (e.g. Time tracking), the section and who has access.
- Right after the space details, in the establishment step, check the prefilled details (CNPJ or CPF, CEI/CAEPF/CNO, legal name, workplace), or pick one the community already has.
- Save. The space opens linked to the establishment.
Register the employees
Role: time tracking management.
- In the space, open Employees: the list shows who has access and doesn't have a record yet.
- For each one, enter the CPF, hire date and job title or role (and the eSocial registration, if there is one).
Set the rules
Role: time tracking management.
- Rules and holidays › Rules, with Rule for: The whole space.
- Adjust Working hours, Tolerance and overtime (with the Pay or Hour bank destination) and Night and breaks.
- Choose Effective from and save.
- For someone with a different schedule, Rule for: Exception and the person (or Also apply to and a group).
- In Holidays, Add holiday for the city's or the company's.
Clock in/out
- Open the time tracking space, on the Clock in/out tab.
- The first time, read the IP and location notice.
- Clock in/out. Open the receipt, if you want; earlier ones stay in Punches › Mine.
Request an adjustment
- In Timesheet › Day by day, on the day, Request adjustment (it doesn't show on future days).
- Include (with the time) or Disregard (picking the punch), with the reason.
- Follow it in Adjustments › My requests; while it waits, you can Cancel request.
Close the month
Role: time tracking management.
- In Adjustments › To decide, decide the waiting ones (those of people without a leader belong to the management team; for the others, ask the leaders).
- In Team month, review the totals and flags.
- Manage the month › Close month. Each employee gets the e-mail to acknowledge.
- Export CSV for payroll.
Examples
A small company. Luma creates the Time tracking space; the establishment comes with the CNPJ and legal name from the company details. The management team registers Carla and Bruno with CPF, hire date and job title. Carla punches at 08:02, 12:01, 13:00 and 17:04: all within the tolerance, 8 regular hours.
Forgot to punch. Bruno didn't punch out on Tuesday. On the timesheet, the day shows missing out. He requests to include 18:00, with the reason "I forgot to punch out". Diego, his leader, gets the e-mail and approves: the timesheet shows the included out, with the reason; the AFD still doesn't have it.
Hour bank. With the bank destination and a 6-month validity, Carla's 3 h of overtime in January go in as a credit and expire at the end of June. In February she leaves 1 h early one day: the bank debits 1 h from January's batch.
An auditor asks for the files. Finance generates the AFD (in Establishment, AFD and AEJ) and the AEJ for the establishment from January to March and hands over both with their .sha256.
Common errors and how to fix them
| Situation | Why | What to do |
|---|---|---|
| "You have no employee registration in this space yet. Ask the time tracking management." | The person opens the space but wasn't registered | The management team registers the person with CPF, hire date and job title |
| "This space has no establishment yet. Ask the time tracking management." | The space was created, but the establishment wasn't saved | The management team registers it in Establishment, AFD and AEJ, in the space itself |
| "Invalid employer's CNPJ or CPF." or "Invalid CPF." | The check digit doesn't match | Check the number |
| "Enter the CPF of the person registering: it goes into the record." | Whoever saves the establishment didn't enter their own CPF | Enter your CPF |
| "The person needs access to a time tracking space of this establishment." | The space is private and the person isn't in its audience | Give them access to the space before registering |
| "This space already has punches: its establishment cannot change." | The punches were made in the current establishment's name | Create another space for the other employer |
| "Only the person's direct leader decides this adjustment (or the management, if they have no leader)." | You are an indirect leader, or you don't lead the person | Ask the direct leader |
| "You cannot decide your own adjustment." | Nobody decides their own adjustment | Your leader decides or, without a leader, someone else in the management team |
| "Months close in order: close the previous month first." | There is an earlier month still open | Close the earlier one first |
| "There are 2 adjustment(s) waiting for a decision in this month." | The month has pending adjustments | Decide the adjustments and close again |
| "The month 2026-09 is closed: reopen it before changing it." | An adjustment, rule or holiday in a closed month | The owner or the admin reopens the month, with the reason |
| "Reopen the most recent months first." | There is a later month that is closed | Reopen from the most recent backwards |
| "You are … m from the workplace, outside the allowed radius of … m. The punch was not recorded." | The space has a radius in Block mode and the person is outside it | Punch from the workplace, or ask your leader for an adjustment |
| "This time clock only accepts punches with location. Turn on your device location and try again." | Block mode, and the device gave no location | Allow location in the browser or on the phone and try again |
Frequently asked questions
Can I fix a wrong punch? The punch isn't edited. Request a Disregard adjustment, with the reason; once approved, the timesheet stops counting it, and the original record stays there.
Without a location, does the punch count? Without an allowed radius, or with the radius in Flag mode, it does: it goes in and is flagged no location on the timesheet and in the CSV. With the radius in Block mode, it is refused.
Does time tracking block someone who punches outside the schedule? No. No working-hours rule rejects the punch; outside the schedule, it is only flagged. What can refuse it is the allowed radius, in Block mode, and only by distance.
Does the indirect leader decide adjustments? No. They see the team's timesheet, but the direct leader decides (or the management team, for people without a leader).
Does the assistant clock in for me? No. Punching is the person's own act, in the app. The assistant looks up the timesheet, the receipts and the adjustments, requests adjustments and acknowledges.
How long are the punches kept? Forever. Nothing in the record expires or is deleted.
In the API
The space is module: "timeTracking", and a community can have several. The routes are under /api/time-tracking, with the X-CommunityId and the spaceId (required when there is more than one time tracking space): GET /clock; GET /establishments/prefill, GET and POST /establishments, GET and PATCH /establishments/{id}, POST /establishments/{id}/afd and /aej; GET and PUT /spaces/{spaceId}, GET /spaces/{spaceId}/people; GET and POST /employees, PATCH and DELETE /employees/{id}; POST /notice; GET and POST /punches, GET /punches/{id} and /punches/{id}/receipt; GET and POST /rules; GET and POST /holidays, DELETE /holidays/{id}; GET and POST /adjustments, GET /adjustments/{id}, POST /adjustments/{id}/decision and /cancel; GET /timesheet, GET /timesheets; GET /months, POST /months/close, /reopen and /acknowledge; POST /exports/csv. There is no route that changes or deletes a punch. Anyone who can't see a timesheet or a punch gets 404; management actions return 403 managementOnly for the other roles, and a closed month is 422 monthClosed.
Allowed radius: PUT and DELETE /api/time-tracking/spaces/{spaceId}/geofence (latitude, longitude, radiusMeters from 10 to 50,000, mode BLOCK or FLAG and an optional address), only for the owner and the admin (403 geofenceDenied); GET /api/time-tracking/geofence-refusals (spaceId, memberId, pagination) for the management. In BLOCK mode, POST /punches outside the radius or without a location returns 422 (geofenceOutside, geofenceNoLocation); punches bring outsideRadius.